Overview

overview

10

Static

static

7

b38019f9e8...fc.apk

android-10-x64

10

b38019f9e8...fc.apk

android-11-x64

10

b38019f9e8...fc.apk

android-9-x86

10

Resubmissions

05-08-2024 12:08

240805-pa55aavhjp 10

02-08-2024 15:48

240802-s893nszfkj 10

03-01-2024 17:25

240103-vzshdabae6 10

24-12-2023 19:17

231224-xznwasbhh7 6

14-12-2023 08:27

231214-kclffacdhn 10

03-11-2023 03:07

231103-dmbwesbb4s 10

01-11-2023 22:00

231101-1wx7cadf5y 10

Analysis

  • max time kernel
    2469431s
  • max time network
    309s
  • platform
    android_x64
  • resource
    android-x64-20231023.1-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231023.1-enlocale:en-usos:android-10-x64system
  • submitted
    03-11-2023 03:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc.apk

  • Size

    509KB

  • MD5

    60609814e43a1c814b30435f15d361ed

  • SHA1

    61431ed485c98b8a291e289a7e17e8d3e6db3660

  • SHA256

    b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc

  • SHA512

    8efba5603fd4217b9c9c96e28a69f9f262568f76d43fd959d6914694808488f089f01fa92e2d04f44d5aa0859efcfb34fb080dc7b3a49502469598ab90a662fe

  • SSDEEP

    12288:KwGWfjEhy4pNodk6TZFo9nheT5BQ4YvnAu:KnWf0y4GNIsmRvnAu

Score
10/10
octobankerevasioninfostealerransomwarerattrojan

Malware Config

Extracted

Family

octo

C2

https://84.54.50.100/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass2.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass3.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass4.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass5.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass6.net/Njk4Zjk4YjdjODY3/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 3 IoCs
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.broughtbluea
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:5051

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.broughtbluea/cache/pxcpq
    Filesize

    449KB

    MD5

    fb15ea8794c6547c5ca8f58577e433a6

    SHA1

    47c530ac1858cbc7584429190a07c3c4313857ac

    SHA256

    908588c8de2b52b69f30917583d91ac67f96c7682c017df3943d3979c9fc6095

    SHA512

    9cb724a385917e949052b84be546cd61a952474ee8671743034463b356de4c5bc60732b07287c326da65c4cced7f8c8247b348bbb5abb436c86fedbcb4da90c9

    Download Submit

  • /data/data/com.broughtbluea/kl.txt
    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

    Download Submit

  • /data/data/com.broughtbluea/kl.txt
    Filesize

    68B

    MD5

    1f75429a6ddebc9ed4c1e23e9ac92548

    SHA1

    218135a60e1177aea478ba6ee66941303a592104

    SHA256

    be66cf53b03a53b83ded8a7ca97d14bfd8220e3d19690aeb78557b3d295d08b5

    SHA512

    0c49fa9658f4e9072fcd88775f24301bbcafd96a54eb849843da6b3d296e64cfa8cfd8ab8bab76f9d70c5cd9f95caae2485bfecec19b1a1564c1454f77c2dd10

    Download Submit

  • /data/data/com.broughtbluea/kl.txt
    Filesize

    76B

    MD5

    36642c7b8e2f93f38ecf10bf686b8280

    SHA1

    0d935e41ff66cbc2ae7ddcff0828f711278f661a

    SHA256

    4aab1ad2398c6e0972dffa5eb69d6cb8e3f2ed98df84e84c8f7e11a883ca7cac

    SHA512

    3735947ce4660860bc9303bbe5d6032556f53f77b24eb3582989d9e1928da74cdb3474a75d233a5796081262007cc6cf2e0daddd5f21b88ab87dea502cae04da

    Download Submit

  • /data/data/com.broughtbluea/kl.txt
    Filesize

    230B

    MD5

    6a15c42f51b0c93f98dfdb736c5a53af

    SHA1

    bb308d3b38c5a0641e977a8e3d02bb4291eb14f7

    SHA256

    724984f349f3cba0b44609910a7e19a3bb38f6a30b06e70bb7a4d2f26b7db41e

    SHA512

    2742594ff525801149d1a438734f4fda13e81b393c78c65aa8cbe965f6836b57427ee71bbefef0c157b1ae49486230beaa89ee6228372728ba52c5c24f8adefb

    Download Submit

  • /data/data/com.broughtbluea/kl.txt
    Filesize

    76B

    MD5

    bd73973d15dd37a262ab9587953874cc

    SHA1

    ef14e4596fc8d48a11d80322a1da36260f7aa138

    SHA256

    07beaf0cff2d7b65b5bb6fbb62cfcd5960a76fc6a47e24dec90d75379c1d8ee3

    SHA512

    fca95d4ef6ef22659d8eb5f941577e3e3a73adf761b0bb3c5f5ad00c33951bff088678420133a8b2bb56999ebe0eb00077b29896753988960e084b2df949f2f8

    Download Submit

  • /data/user/0/com.broughtbluea/cache/pxcpq
    Filesize

    449KB

    MD5

    fb15ea8794c6547c5ca8f58577e433a6

    SHA1

    47c530ac1858cbc7584429190a07c3c4313857ac

    SHA256

    908588c8de2b52b69f30917583d91ac67f96c7682c017df3943d3979c9fc6095

    SHA512

    9cb724a385917e949052b84be546cd61a952474ee8671743034463b356de4c5bc60732b07287c326da65c4cced7f8c8247b348bbb5abb436c86fedbcb4da90c9

    Download Submit

  • /data/user/0/com.broughtbluea/cache/pxcpq
    Filesize

    449KB

    MD5

    fb15ea8794c6547c5ca8f58577e433a6

    SHA1

    47c530ac1858cbc7584429190a07c3c4313857ac

    SHA256

    908588c8de2b52b69f30917583d91ac67f96c7682c017df3943d3979c9fc6095

    SHA512

    9cb724a385917e949052b84be546cd61a952474ee8671743034463b356de4c5bc60732b07287c326da65c4cced7f8c8247b348bbb5abb436c86fedbcb4da90c9

    Download Submit